CVE-2025-46706: F5 BIG-IP Next CNF DoS Vulnerability

CVE-2025-46706 Overview

CVE-2025-46706 is a resource exhaustion vulnerability affecting F5 BIG-IP products when an iRule containing the HTTP::respond command is configured on a virtual server. Specially crafted requests can trigger uncontrolled memory resource consumption, potentially leading to denial of service conditions. This vulnerability affects a wide range of F5 BIG-IP modules and related cloud-native products.

Critical Impact

Unauthenticated attackers can remotely exhaust memory resources on affected F5 BIG-IP devices, potentially causing service disruption for critical network infrastructure.

Affected Products

• F5 BIG-IP Local Traffic Manager
• F5 BIG-IP Application Security Manager
• F5 BIG-IP Advanced Web Application Firewall
• F5 BIG-IP Access Policy Manager
• F5 BIG-IP Advanced Firewall Manager
• F5 BIG-IP Global Traffic Manager
• F5 BIG-IP Domain Name System
• F5 BIG-IP SSL Orchestrator
• F5 BIG-IP Next Cloud-Native Network Functions
• F5 BIG-IP Next Service Proxy for Kubernetes
• F5 BIG-IP Analytics, Application Acceleration Manager, and additional modules

Discovery Timeline

• October 15, 2025 - CVE-2025-46706 published to NVD
• October 21, 2025 - Last updated in NVD database

Technical Details for CVE-2025-46706

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw exists within the iRule processing engine when handling the HTTP::respond command on virtual servers. When an attacker sends specially crafted HTTP requests to an affected virtual server, the system fails to properly manage memory allocation, resulting in unbounded memory consumption.

The attack can be executed remotely over the network without requiring authentication or user interaction. The vulnerability specifically impacts availability—while confidentiality and integrity remain unaffected, a successful exploit can render the BIG-IP device unresponsive, disrupting traffic management and security services for all dependent applications.

Root Cause

The root cause lies in improper resource allocation controls within the iRule HTTP::respond command handler. When processing certain undisclosed request patterns, the system allocates memory without proper bounds checking or cleanup mechanisms. This allows an attacker to trigger repeated memory allocations that accumulate over time, eventually exhausting available system memory.

The vulnerability affects configurations where iRules use the HTTP::respond command to generate responses directly from the BIG-IP device. This is a common pattern for implementing custom error pages, redirects, health check responses, and other dynamic content generation scenarios.

Attack Vector

The attack vector is network-based, requiring only that the attacker can send HTTP requests to a virtual server configured with a vulnerable iRule. The exploitation process involves:

1. Identifying a BIG-IP virtual server with an iRule using HTTP::respond
2. Sending specially crafted HTTP requests designed to trigger the memory allocation flaw
3. Repeating requests to progressively consume available memory
4. Continuing until the device becomes unresponsive or crashes

Since no authentication is required and the attack can be executed with standard HTTP requests, the barrier to exploitation is relatively low for any attacker with network access to the virtual server.

Detection Methods for CVE-2025-46706

Indicators of Compromise

• Unusual memory consumption patterns on BIG-IP devices, particularly the Traffic Management Microkernel (TMM) process
• Gradual memory depletion without corresponding increases in legitimate traffic volume
• Repeated HTTP requests from single sources or unusual request patterns targeting virtual servers with iRules
• System log entries indicating memory pressure or TMM process restarts

Detection Strategies

• Monitor TMM memory utilization through SNMP polling or BIG-IP iHealth diagnostics
• Implement network-based detection for anomalous HTTP request patterns targeting BIG-IP virtual servers
• Configure alerts for memory usage exceeding baseline thresholds on BIG-IP devices
• Review iRule configurations to identify virtual servers using HTTP::respond commands that may be vulnerable

Monitoring Recommendations

• Enable BIG-IP system logging at appropriate verbosity to capture memory allocation events
• Deploy network monitoring to track request volumes and patterns to BIG-IP virtual servers
• Establish memory utilization baselines and configure automated alerting for deviations
• Implement regular iHealth diagnostic checks to identify early signs of resource exhaustion

How to Mitigate CVE-2025-46706

Immediate Actions Required

• Review all iRule configurations to identify virtual servers using the HTTP::respond command
• Apply vendor patches as they become available from F5
• Consider temporarily disabling or modifying vulnerable iRules if patches are not immediately available
• Implement rate limiting and connection controls to reduce exposure to resource exhaustion attacks
• Monitor affected devices for signs of memory exhaustion

Patch Information

F5 has published a security advisory addressing this vulnerability. Organizations should consult the F5 Knowledge Article K000151611 for specific version information, patch availability, and detailed remediation guidance. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated and may remain vulnerable.

Workarounds

• Implement network-level access controls to restrict which sources can reach vulnerable virtual servers
• Configure connection and request rate limits on affected virtual servers to slow potential exploitation
• Review and optimize iRule logic to minimize use of HTTP::respond where alternative approaches are feasible
• Consider implementing request filtering at upstream network devices to block malicious request patterns

# Example: Check for iRules using HTTP::respond command
tmsh list ltm rule | grep -B5 "HTTP::respond"

# Example: Configure connection limits on virtual server
tmsh modify ltm virtual /Common/vulnerable_vs connection-limit 10000
tmsh modify ltm virtual /Common/vulnerable_vs rate-limit 1000